slachiewicz opened a new pull request, #763: URL: https://github.com/apache/maven-pmd-plugin/pull/763
Most of the audit findings come from `wiremock` 2.27.2 (test scope), which pins jetty 9.2.28, jackson 2.11.0, handlebars 4.0.7, json-smart 2.3 and commons-fileupload 1.4. The artifact moves to `wiremock-jre8` 2.35.2, the Java 8 line that replaced it, and those libraries are managed to jetty 9.4.58, jackson 2.21.8, handlebars 4.5.8, json-smart 2.4.11 and commons-fileupload 1.6.0. Moving to wiremock 3 would need Java 11 and jetty 11, so it is left out. `commons-beanutils` 1.9.4 (GHSA-wxr5-93ph-8wr9) arrives at compile scope through `maven-reporting-impl`, so the 1.11.0 override reaches the published plugin; everything else here is tests only. Verified: `mvn verify -Dinvoker.skip` → pass (74 tests, 8 skipped; ITs not run) Part of apache/maven#13755 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
